From 7367488e28187b8cf97d25ac8f0f07ecb92d4285 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Thu, 4 Jun 2026 16:44:58 +0000
Subject: [PATCH] fix: recheck hwlab v02 head before reuse

---
 scripts/hwlab-g14-contract-test.ts |  28 ++++++-
 scripts/src/hwlab-g14.ts           | 113 +++++++++++++++++++++++++----
 2 files changed, 124 insertions(+), 17 deletions(-)

diff --git a/scripts/hwlab-g14-contract-test.ts b/scripts/hwlab-g14-contract-test.ts
index 0a24bf56..4905f0ba 100644
--- a/scripts/hwlab-g14-contract-test.ts
+++ b/scripts/hwlab-g14-contract-test.ts
@@ -1,4 +1,4 @@
-import { gitMirrorFlushJobManifest, gitMirrorStatusSummary, gitMirrorSyncJobManifest, gitMirrorV02SyncRequirement, hwlabG14Help, hwlabG14MonitorStateFileName, parseGitMirrorStatusRefs, parsePipelineTaskRunMetrics, rolloutRecordBody, semanticChangelogBullets, v02CommitAlignment, v02ControlPlaneRefreshScriptHash, v02ControlPlaneRenderScript, v02FalseGreenGuard, v02LatestOnlyTargetValidation, v02PipelineServiceIds, v02PrAutomationCommentBody, v02ReusableGitMirrorPreSyncMarker, v02ReusableRefreshMarker, v02TaskRunPerformanceSummary } from "./src/hwlab-g14";
+import { gitMirrorFlushJobManifest, gitMirrorStatusSummary, gitMirrorSyncJobManifest, gitMirrorV02SyncRequirement, hwlabG14Help, hwlabG14MonitorStateFileName, parseGitMirrorStatusRefs, parsePipelineTaskRunMetrics, rolloutRecordBody, semanticChangelogBullets, v02CommitAlignment, v02ControlPlaneRefreshScriptHash, v02ControlPlaneRenderScript, v02ExistingPipelineRunReuseDecision, v02FalseGreenGuard, v02LatestOnlyTargetValidation, v02PipelineServiceIds, v02PrAutomationCommentBody, v02ReusableGitMirrorPreSyncMarker, v02ReusableRefreshMarker, v02TaskRunPerformanceSummary } from "./src/hwlab-g14";
 
 function assertCondition(condition: unknown, message: string, detail: unknown = {}): void {
   if (!condition) throw new Error(`${message}: ${JSON.stringify(detail)}`);
@@ -208,6 +208,31 @@ assertCondition(
   "v0.2 control-plane render must not use the fixed workspace checkout or its clean status",
   renderScript,
 );
+const existingPipelineRunReuse = v02ExistingPipelineRunReuseDecision({
+  sourceCommit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  before: { exists: true, status: "True" },
+  latestSourceCommit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+});
+const existingPipelineRunFailed = v02ExistingPipelineRunReuseDecision({
+  sourceCommit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  before: { exists: true, status: "False" },
+  latestSourceCommit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+});
+const existingPipelineRunHeadAdvanced = v02ExistingPipelineRunReuseDecision({
+  sourceCommit: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  before: { exists: true, status: "True" },
+  latestSourceCommit: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+});
+assertCondition(
+  existingPipelineRunReuse.reusable === true
+    && existingPipelineRunReuse.alreadyUsable === true
+    && existingPipelineRunFailed.reusable === true
+    && existingPipelineRunFailed.alreadyUsable === false
+    && existingPipelineRunHeadAdvanced.reusable === false
+    && existingPipelineRunHeadAdvanced.reason === "source-head-advanced-before-existing-pipelinerun-reuse",
+  "trigger-current must recheck latest v0.2 head before reusing an existing PipelineRun",
+  { existingPipelineRunReuse, existingPipelineRunFailed, existingPipelineRunHeadAdvanced },
+);
 assertCondition(
   !v02PipelineServiceIds().includes("hwlab-cli"),
   "v0.2 PipelineRun service matrix must not build hwlab-cli because cli is short-connection source tool",
@@ -487,6 +512,7 @@ console.log(JSON.stringify({
     "v0.2 control-plane status help exposes targeted PipelineRun/source-commit inspection",
     "v0.2 control-plane render uses an isolated temp clone from a CI/CD dedicated bare repo",
     "v0.2 control-plane refresh marker only reuses recent same-contract refreshes",
+    "trigger-current rechecks latest v0.2 head before reusing an existing PipelineRun",
     "v0.2 status alignment reports stale-success without coupling CI to dirty workspace state",
     "v0.2 PipelineRun service matrix excludes hwlab-cli",
     "v0.2 false-green guard checks build TaskRuns, runtime artifact source commits, and reuse provenance",
diff --git a/scripts/src/hwlab-g14.ts b/scripts/src/hwlab-g14.ts
index dea44923..3c28be10 100644
--- a/scripts/src/hwlab-g14.ts
+++ b/scripts/src/hwlab-g14.ts
@@ -672,6 +672,36 @@ function v02PipelineRunName(sourceCommit: string): string {
   return `${V02_PIPELINERUN_PREFIX}-${shortSha(sourceCommit)}`;
 }
 
+export function v02ExistingPipelineRunReuseDecision(input: {
+  sourceCommit: string;
+  before: Record<string, unknown>;
+  latestSourceCommit: string | null;
+}): Record<string, unknown> {
+  const status = stringOrNull(input.before.status);
+  const exists = input.before.exists === true;
+  const latestSourceCommit = input.latestSourceCommit;
+  const alreadyUsable = exists && (status === "True" || status === "Unknown");
+  if (latestSourceCommit !== null && latestSourceCommit !== input.sourceCommit) {
+    return {
+      reusable: false,
+      alreadyUsable,
+      reason: "source-head-advanced-before-existing-pipelinerun-reuse",
+      sourceCommit: input.sourceCommit,
+      latestSourceCommit,
+      previousPipelineRun: v02PipelineRunName(input.sourceCommit),
+      latestPipelineRun: v02PipelineRunName(latestSourceCommit),
+    };
+  }
+  return {
+    reusable: exists && status !== null,
+    alreadyUsable,
+    reason: alreadyUsable ? "existing-pipelinerun-reused" : "existing-pipelinerun-terminal-failed",
+    sourceCommit: input.sourceCommit,
+    latestSourceCommit,
+    previousPipelineRun: v02PipelineRunName(input.sourceCommit),
+  };
+}
+
 function getPipelineRunCompact(name: string): Record<string, unknown> {
   const result = g14K3s([
     "kubectl",
@@ -2513,7 +2543,7 @@ function runV02ControlPlane(options: G14ControlPlaneOptions): Record<string, unk
   if (options.action === "status" && options.pipelineRun !== undefined) return v02ControlPlaneStatus({ pipelineRun: options.pipelineRun, mode: "pipeline-run" });
   if (options.action === "status" && options.sourceCommit !== undefined) return v02ControlPlaneStatus({ sourceCommit: options.sourceCommit, mode: "source-commit" });
   const head = resolveV02Head();
-  const sourceCommit = head.sourceCommit;
+  let sourceCommit = head.sourceCommit;
   if (sourceCommit === null) {
     return { ok: false, command: `hwlab g14 control-plane ${options.action} --lane v02`, degradedReason: "v02-head-unresolved", sourceRepo: V02_CICD_REPO, workspace: V02_WORKSPACE, headProbe: compactCommandResult(head.result) };
   }
@@ -2550,7 +2580,7 @@ function runV02ControlPlane(options: G14ControlPlaneOptions): Record<string, unk
       : { triggerCurrent: "bun scripts/cli.ts hwlab g14 control-plane trigger-current --lane v02 --confirm" },
     };
   }
-  const before = getPipelineRunCompact(v02PipelineRunName(sourceCommit));
+  let before = getPipelineRunCompact(v02PipelineRunName(sourceCommit));
   if (options.dryRun) {
     const gitMirrorPreSync = preSyncV02GitMirror(sourceCommit, options);
     return {
@@ -2572,20 +2602,71 @@ function runV02ControlPlane(options: G14ControlPlaneOptions): Record<string, unk
     };
   }
   if (before.exists === true && before.status !== null) {
-    const alreadyUsable = before.status === "True" || before.status === "Unknown";
-    return {
-      ok: alreadyUsable,
-      command: "hwlab g14 control-plane trigger-current --lane v02",
-      lane: "v02",
-      mode: "confirmed-trigger",
-      sourceCommit,
-      pipelineRun: v02PipelineRunName(sourceCommit),
-      before,
-      skipped: true,
-      reason: alreadyUsable ? "existing-pipelinerun-reused" : "existing-pipelinerun-terminal-failed",
-      degradedReason: alreadyUsable ? undefined : "existing-pipelinerun-terminal-failed",
-      latestOnlyPolicy: "same source commit is idempotent; existing PipelineRun is never deleted or recreated by default",
-    };
+    const latestHead = resolveV02Head();
+    const reuseDecision = v02ExistingPipelineRunReuseDecision({ sourceCommit, before, latestSourceCommit: latestHead.sourceCommit });
+    if (reuseDecision.reusable === true) {
+      const alreadyUsable = reuseDecision.alreadyUsable === true;
+      return {
+        ok: alreadyUsable,
+        command: "hwlab g14 control-plane trigger-current --lane v02",
+        lane: "v02",
+        mode: "confirmed-trigger",
+        sourceCommit,
+        pipelineRun: v02PipelineRunName(sourceCommit),
+        before,
+        skipped: true,
+        reuseDecision,
+        reason: reuseDecision.reason,
+        degradedReason: alreadyUsable ? undefined : "existing-pipelinerun-terminal-failed",
+        latestOnlyPolicy: "same source commit is idempotent; existing PipelineRun is never deleted or recreated by default; source head is rechecked before reuse",
+      };
+    }
+    if (latestHead.sourceCommit !== null && latestHead.sourceCommit !== sourceCommit) {
+      printProgressEvent("hwlab.v02.trigger.progress", {
+        stage: "source-head-recheck",
+        status: "advanced",
+        sourceCommit,
+        latestSourceCommit: latestHead.sourceCommit,
+        previousPipelineRun: v02PipelineRunName(sourceCommit),
+        latestPipelineRun: v02PipelineRunName(latestHead.sourceCommit),
+      });
+      sourceCommit = latestHead.sourceCommit;
+      before = getPipelineRunCompact(v02PipelineRunName(sourceCommit));
+      if (before.exists === true && before.status !== null) {
+        const advancedAlreadyUsable = before.status === "True" || before.status === "Unknown";
+        return {
+          ok: advancedAlreadyUsable,
+          command: "hwlab g14 control-plane trigger-current --lane v02",
+          lane: "v02",
+          mode: "confirmed-trigger",
+          sourceCommit,
+          pipelineRun: v02PipelineRunName(sourceCommit),
+          before,
+          skipped: true,
+          reuseDecision: {
+            ...reuseDecision,
+            advancedSourceCommit: sourceCommit,
+            advancedPipelineRun: v02PipelineRunName(sourceCommit),
+            advancedPipelineRunStatus: before.status ?? null,
+          },
+          reason: advancedAlreadyUsable ? "advanced-existing-pipelinerun-reused" : "advanced-existing-pipelinerun-terminal-failed",
+          degradedReason: advancedAlreadyUsable ? undefined : "advanced-existing-pipelinerun-terminal-failed",
+          latestOnlyPolicy: "same source commit is idempotent; existing PipelineRun is never deleted or recreated by default; source head is rechecked before reuse",
+        };
+      }
+    } else {
+      return {
+        ok: false,
+        command: "hwlab g14 control-plane trigger-current --lane v02",
+        lane: "v02",
+        mode: "confirmed-trigger",
+        sourceCommit,
+        pipelineRun: v02PipelineRunName(sourceCommit),
+        before,
+        reuseDecision,
+        degradedReason: "existing-pipelinerun-reuse-rejected",
+      };
+    }
   }
   printProgressEvent("hwlab.v02.trigger.progress", { stage: "control-plane-refresh", status: "started", sourceCommit, pipelineRun: v02PipelineRunName(sourceCommit) });
   const controlPlaneRefresh = refreshV02ControlPlaneBeforeTrigger(sourceCommit, options.timeoutSeconds);